Under GDPR, people about whom you hold any personal data (known as 'data subjects') have the right to request access to that data. This is known as a Subject Access Request or SAR.
In the context of an out of school club, you are most likely to receive a SAR from parents of children at your club or from current or former employees, or from a third party, such as a solicitor, acting on their behalf. A SAR can be made in writing or verbally, and you must respond within one month of the request being made. Failure to do so may result in a fine from the ICO (Information Commissioner's Office).
To read more about how to respond to Subject Access Requests, please log in.